1/*
2 *	Based on LiMon - BOOTP.
3 *
4 *	Copyright 1994, 1995, 2000 Neil Russell.
5 *	(See License)
6 *	Copyright 2000 Roland Borde
7 *	Copyright 2000 Paolo Scaffardi
8 *	Copyright 2000-2004 Wolfgang Denk, wd@denx.de
9 */
10
11#include <common.h>
12#include <bootstage.h>
13#include <command.h>
14#include <env.h>
15#include <efi_loader.h>
16#include <log.h>
17#include <net.h>
18#include <rand.h>
19#include <uuid.h>
20#include <linux/delay.h>
21#include <net/tftp.h>
22#include "bootp.h"
23#ifdef CONFIG_LED_STATUS
24#include <status_led.h>
25#endif
26#ifdef CONFIG_BOOTP_RANDOM_DELAY
27#include "net_rand.h"
28#endif
29#include <malloc.h>
30
31#define BOOTP_VENDOR_MAGIC	0x63825363	/* RFC1048 Magic Cookie */
32
33/*
34 * The timeout for the initial BOOTP/DHCP request used to be described by a
35 * counter of fixed-length timeout periods. CONFIG_NET_RETRY_COUNT represents
36 * that counter
37 *
38 * Now that the timeout periods are variable (exponential backoff and retry)
39 * we convert the timeout count to the absolute time it would have take to
40 * execute that many retries, and keep sending retry packets until that time
41 * is reached.
42 */
43#define TIMEOUT_MS	((3 + (CONFIG_NET_RETRY_COUNT * 5)) * 1000)
44
45#ifndef CFG_DHCP_MIN_EXT_LEN		/* minimal length of extension list */
46#define CFG_DHCP_MIN_EXT_LEN 64
47#endif
48
49#ifndef CFG_BOOTP_ID_CACHE_SIZE
50#define CFG_BOOTP_ID_CACHE_SIZE 4
51#endif
52
53u32		bootp_ids[CFG_BOOTP_ID_CACHE_SIZE];
54unsigned int	bootp_num_ids;
55int		bootp_try;
56ulong		bootp_start;
57ulong		bootp_timeout;
58char net_nis_domain[32] = {0,}; /* Our NIS domain */
59char net_hostname[32] = {0,}; /* Our hostname */
60char net_root_path[CONFIG_BOOTP_MAX_ROOT_PATH_LEN] = {0,}; /* Our bootpath */
61
62static ulong time_taken_max;
63
64#if defined(CONFIG_CMD_DHCP)
65static dhcp_state_t dhcp_state = INIT;
66static u32 dhcp_leasetime;
67static struct in_addr dhcp_server_ip;
68static u8 dhcp_option_overload;
69#define OVERLOAD_FILE 1
70#define OVERLOAD_SNAME 2
71static void dhcp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
72			unsigned src, unsigned len);
73
74/* For Debug */
75#if 0
76static char *dhcpmsg2str(int type)
77{
78	switch (type) {
79	case 1:	 return "DHCPDISCOVER"; break;
80	case 2:	 return "DHCPOFFER";	break;
81	case 3:	 return "DHCPREQUEST";	break;
82	case 4:	 return "DHCPDECLINE";	break;
83	case 5:	 return "DHCPACK";	break;
84	case 6:	 return "DHCPNACK";	break;
85	case 7:	 return "DHCPRELEASE";	break;
86	default: return "UNKNOWN/INVALID MSG TYPE"; break;
87	}
88}
89#endif
90#endif
91
92static void bootp_add_id(ulong id)
93{
94	if (bootp_num_ids >= ARRAY_SIZE(bootp_ids)) {
95		size_t size = sizeof(bootp_ids) - sizeof(id);
96
97		memmove(bootp_ids, &bootp_ids[1], size);
98		bootp_ids[bootp_num_ids - 1] = id;
99	} else {
100		bootp_ids[bootp_num_ids] = id;
101		bootp_num_ids++;
102	}
103}
104
105static bool bootp_match_id(ulong id)
106{
107	unsigned int i;
108
109	for (i = 0; i < bootp_num_ids; i++)
110		if (bootp_ids[i] == id)
111			return true;
112
113	return false;
114}
115
116static int check_reply_packet(uchar *pkt, unsigned dest, unsigned src,
117			      unsigned len)
118{
119	struct bootp_hdr *bp = (struct bootp_hdr *)pkt;
120	int retval = 0;
121
122	if (dest != PORT_BOOTPC || src != PORT_BOOTPS)
123		retval = -1;
124	else if (len < sizeof(struct bootp_hdr) - OPT_FIELD_SIZE)
125		retval = -2;
126	else if (bp->bp_op != OP_BOOTREPLY)
127		retval = -3;
128	else if (bp->bp_htype != HWT_ETHER)
129		retval = -4;
130	else if (bp->bp_hlen != HWL_ETHER)
131		retval = -5;
132	else if (!bootp_match_id(net_read_u32(&bp->bp_id)))
133		retval = -6;
134	else if (memcmp(bp->bp_chaddr, net_ethaddr, HWL_ETHER) != 0)
135		retval = -7;
136
137	debug("Filtering pkt = %d\n", retval);
138
139	return retval;
140}
141
142static void store_bootp_params(struct bootp_hdr *bp)
143{
144	struct in_addr tmp_ip;
145	bool overwrite_serverip = true;
146
147	if (IS_ENABLED(CONFIG_BOOTP_SERVERIP))
148		return;
149
150#if defined(CONFIG_BOOTP_PREFER_SERVERIP)
151	overwrite_serverip = false;
152#endif
153
154	net_copy_ip(&tmp_ip, &bp->bp_siaddr);
155	if (tmp_ip.s_addr != 0 && (overwrite_serverip || !net_server_ip.s_addr))
156		net_copy_ip(&net_server_ip, &bp->bp_siaddr);
157	memcpy(net_server_ethaddr,
158	       ((struct ethernet_hdr *)net_rx_packet)->et_src, 6);
159	if (
160#if defined(CONFIG_CMD_DHCP)
161	    !(dhcp_option_overload & OVERLOAD_FILE) &&
162#endif
163	    (strlen(bp->bp_file) > 0) &&
164	    !net_boot_file_name_explicit) {
165		copy_filename(net_boot_file_name, bp->bp_file,
166			      sizeof(net_boot_file_name));
167	}
168
169	debug("net_boot_file_name: %s\n", net_boot_file_name);
170
171	/* Propagate to environment:
172	 * don't delete exising entry when BOOTP / DHCP reply does
173	 * not contain a new value
174	 */
175	if (*net_boot_file_name)
176		env_set("bootfile", net_boot_file_name);
177}
178
179/*
180 * Copy parameters of interest from BOOTP_REPLY/DHCP_OFFER packet
181 */
182static void store_net_params(struct bootp_hdr *bp)
183{
184#if !defined(CONFIG_SERVERIP_FROM_PROXYDHCP)
185	store_bootp_params(bp);
186#endif
187	net_copy_ip(&net_ip, &bp->bp_yiaddr);
188}
189
190static int truncate_sz(const char *name, int maxlen, int curlen)
191{
192	if (curlen >= maxlen) {
193		printf("*** WARNING: %s is too long (%d - max: %d)"
194			" - truncated\n", name, curlen, maxlen);
195		curlen = maxlen - 1;
196	}
197	return curlen;
198}
199
200#if !defined(CONFIG_CMD_DHCP)
201
202static void bootp_process_vendor_field(u8 *ext)
203{
204	int size = *(ext + 1);
205
206	debug("[BOOTP] Processing extension %d... (%d bytes)\n", *ext,
207	      *(ext + 1));
208
209	net_boot_file_expected_size_in_blocks = 0;
210
211	switch (*ext) {
212		/* Fixed length fields */
213	case 1:			/* Subnet mask */
214		if (net_netmask.s_addr == 0)
215			net_copy_ip(&net_netmask, (struct in_addr *)(ext + 2));
216		break;
217	case 2:			/* Time offset - Not yet supported */
218		break;
219		/* Variable length fields */
220	case 3:			/* Gateways list */
221		if (net_gateway.s_addr == 0)
222			net_copy_ip(&net_gateway, (struct in_addr *)(ext + 2));
223		break;
224	case 4:			/* Time server - Not yet supported */
225		break;
226	case 5:			/* IEN-116 name server - Not yet supported */
227		break;
228	case 6:
229		if (net_dns_server.s_addr == 0)
230			net_copy_ip(&net_dns_server,
231				    (struct in_addr *)(ext + 2));
232#if defined(CONFIG_BOOTP_DNS2)
233		if ((net_dns_server2.s_addr == 0) && (size > 4))
234			net_copy_ip(&net_dns_server2,
235				    (struct in_addr *)(ext + 2 + 4));
236#endif
237		break;
238	case 7:			/* Log server - Not yet supported */
239		break;
240	case 8:			/* Cookie/Quote server - Not yet supported */
241		break;
242	case 9:			/* LPR server - Not yet supported */
243		break;
244	case 10:		/* Impress server - Not yet supported */
245		break;
246	case 11:		/* RPL server - Not yet supported */
247		break;
248	case 12:		/* Host name */
249		if (net_hostname[0] == 0) {
250			size = truncate_sz("Host Name",
251				sizeof(net_hostname), size);
252			memcpy(&net_hostname, ext + 2, size);
253			net_hostname[size] = 0;
254		}
255		break;
256	case 13:		/* Boot file size */
257		if (size == 2)
258			net_boot_file_expected_size_in_blocks =
259				ntohs(*(ushort *)(ext + 2));
260		else if (size == 4)
261			net_boot_file_expected_size_in_blocks =
262				ntohl(*(ulong *)(ext + 2));
263		break;
264	case 14:		/* Merit dump file - Not yet supported */
265		break;
266	case 15:		/* Domain name - Not yet supported */
267		break;
268	case 16:		/* Swap server - Not yet supported */
269		break;
270	case 17:		/* Root path */
271		if (net_root_path[0] == 0) {
272			size = truncate_sz("Root Path",
273				sizeof(net_root_path), size);
274			memcpy(&net_root_path, ext + 2, size);
275			net_root_path[size] = 0;
276		}
277		break;
278	case 18:		/* Extension path - Not yet supported */
279		/*
280		 * This can be used to send the information of the
281		 * vendor area in another file that the client can
282		 * access via TFTP.
283		 */
284		break;
285		/* IP host layer fields */
286	case 40:		/* NIS Domain name */
287		if (net_nis_domain[0] == 0) {
288			size = truncate_sz("NIS Domain Name",
289				sizeof(net_nis_domain), size);
290			memcpy(&net_nis_domain, ext + 2, size);
291			net_nis_domain[size] = 0;
292		}
293		break;
294#if defined(CONFIG_CMD_SNTP) && defined(CONFIG_BOOTP_NTPSERVER)
295	case 42:	/* NTP server IP */
296		net_copy_ip(&net_ntp_server, (struct in_addr *)(ext + 2));
297		break;
298#endif
299		/* Application layer fields */
300	case 43:		/* Vendor specific info - Not yet supported */
301		/*
302		 * Binary information to exchange specific
303		 * product information.
304		 */
305		break;
306		/* Reserved (custom) fields (128..254) */
307	}
308}
309
310static void bootp_process_vendor(u8 *ext, int size)
311{
312	u8 *end = ext + size;
313
314	debug("[BOOTP] Checking extension (%d bytes)...\n", size);
315
316	while ((ext < end) && (*ext != 0xff)) {
317		if (*ext == 0) {
318			ext++;
319		} else {
320			u8 *opt = ext;
321
322			ext += ext[1] + 2;
323			if (ext <= end)
324				bootp_process_vendor_field(opt);
325		}
326	}
327
328	debug("[BOOTP] Received fields:\n");
329	if (net_netmask.s_addr)
330		debug("net_netmask : %pI4\n", &net_netmask);
331
332	if (net_gateway.s_addr)
333		debug("net_gateway	: %pI4", &net_gateway);
334
335	if (net_boot_file_expected_size_in_blocks)
336		debug("net_boot_file_expected_size_in_blocks : %d\n",
337		      net_boot_file_expected_size_in_blocks);
338
339	if (net_hostname[0])
340		debug("net_hostname  : %s\n", net_hostname);
341
342	if (net_root_path[0])
343		debug("net_root_path  : %s\n", net_root_path);
344
345	if (net_nis_domain[0])
346		debug("net_nis_domain : %s\n", net_nis_domain);
347
348#if defined(CONFIG_CMD_SNTP) && defined(CONFIG_BOOTP_NTPSERVER)
349	if (net_ntp_server.s_addr)
350		debug("net_ntp_server : %pI4\n", &net_ntp_server);
351#endif
352}
353
354/*
355 *	Handle a BOOTP received packet.
356 */
357static void bootp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
358			  unsigned src, unsigned len)
359{
360	struct bootp_hdr *bp;
361
362	debug("got BOOTP packet (src=%d, dst=%d, len=%d want_len=%zu)\n",
363	      src, dest, len, sizeof(struct bootp_hdr));
364
365	bp = (struct bootp_hdr *)pkt;
366
367	/* Filter out pkts we don't want */
368	if (check_reply_packet(pkt, dest, src, len))
369		return;
370
371	/*
372	 *	Got a good BOOTP reply.	 Copy the data into our variables.
373	 */
374#if defined(CONFIG_LED_STATUS) && defined(CONFIG_LED_STATUS_BOOT_ENABLE)
375	status_led_set(CONFIG_LED_STATUS_BOOT, CONFIG_LED_STATUS_OFF);
376#endif
377
378	store_net_params(bp);		/* Store net parameters from reply */
379
380	/* Retrieve extended information (we must parse the vendor area) */
381	if (net_read_u32((u32 *)&bp->bp_vend[0]) == htonl(BOOTP_VENDOR_MAGIC))
382		bootp_process_vendor((uchar *)&bp->bp_vend[4], len);
383
384	net_set_timeout_handler(0, (thand_f *)0);
385	bootstage_mark_name(BOOTSTAGE_ID_BOOTP_STOP, "bootp_stop");
386
387	debug("Got good BOOTP\n");
388
389	net_auto_load();
390}
391#endif
392
393/*
394 *	Timeout on BOOTP/DHCP request.
395 */
396static void bootp_timeout_handler(void)
397{
398	ulong time_taken = get_timer(bootp_start);
399
400	if (time_taken >= time_taken_max) {
401#ifdef CONFIG_BOOTP_MAY_FAIL
402		char *ethrotate;
403
404		ethrotate = env_get("ethrotate");
405		if ((ethrotate && strcmp(ethrotate, "no") == 0) ||
406		    net_restart_wrap) {
407			puts("\nRetry time exceeded\n");
408			net_set_state(NETLOOP_FAIL);
409		} else
410#endif
411		{
412			puts("\nRetry time exceeded; starting again\n");
413			net_start_again();
414		}
415	} else {
416		bootp_timeout *= 2;
417		if (bootp_timeout > 2000)
418			bootp_timeout = 2000;
419		net_set_timeout_handler(bootp_timeout, bootp_timeout_handler);
420		bootp_request();
421	}
422}
423
424#define put_vci(e, str)						\
425	do {							\
426		size_t vci_strlen = strlen(str);		\
427		*e++ = 60;	/* Vendor Class Identifier */	\
428		*e++ = vci_strlen;				\
429		memcpy(e, str, vci_strlen);			\
430		e += vci_strlen;				\
431	} while (0)
432
433static u8 *add_vci(u8 *e)
434{
435	char *vci = NULL;
436	char *env_vci = env_get("bootp_vci");
437
438#if defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_NET_VCI_STRING)
439	vci = CONFIG_SPL_NET_VCI_STRING;
440#elif defined(CONFIG_BOOTP_VCI_STRING)
441	vci = CONFIG_BOOTP_VCI_STRING;
442#endif
443
444	if (env_vci)
445		vci = env_vci;
446
447	if (vci)
448		put_vci(e, vci);
449
450	return e;
451}
452
453/*
454 *	Initialize BOOTP extension fields in the request.
455 */
456#if defined(CONFIG_CMD_DHCP)
457static int dhcp_extended(u8 *e, int message_type, struct in_addr server_ip,
458			struct in_addr requested_ip)
459{
460	u8 *start = e;
461	u8 *cnt;
462#ifdef CONFIG_LIB_UUID
463	char *uuid;
464#endif
465	int clientarch = -1;
466
467#if defined(CONFIG_BOOTP_VENDOREX)
468	u8 *x;
469#endif
470#if defined(CONFIG_BOOTP_SEND_HOSTNAME)
471	char *hostname;
472#endif
473
474	*e++ = 99;		/* RFC1048 Magic Cookie */
475	*e++ = 130;
476	*e++ = 83;
477	*e++ = 99;
478
479	*e++ = 53;		/* DHCP Message Type */
480	*e++ = 1;
481	*e++ = message_type;
482
483	*e++ = 57;		/* Maximum DHCP Message Size */
484	*e++ = 2;
485	*e++ = (576 - 312 + OPT_FIELD_SIZE) >> 8;
486	*e++ = (576 - 312 + OPT_FIELD_SIZE) & 0xff;
487
488	if (server_ip.s_addr) {
489		int tmp = ntohl(server_ip.s_addr);
490
491		*e++ = 54;	/* ServerID */
492		*e++ = 4;
493		*e++ = tmp >> 24;
494		*e++ = tmp >> 16;
495		*e++ = tmp >> 8;
496		*e++ = tmp & 0xff;
497	}
498
499	if (requested_ip.s_addr) {
500		int tmp = ntohl(requested_ip.s_addr);
501
502		*e++ = 50;	/* Requested IP */
503		*e++ = 4;
504		*e++ = tmp >> 24;
505		*e++ = tmp >> 16;
506		*e++ = tmp >> 8;
507		*e++ = tmp & 0xff;
508	}
509#if defined(CONFIG_BOOTP_SEND_HOSTNAME)
510	hostname = env_get("hostname");
511	if (hostname) {
512		int hostnamelen = strlen(hostname);
513
514		*e++ = 12;	/* Hostname */
515		*e++ = hostnamelen;
516		memcpy(e, hostname, hostnamelen);
517		e += hostnamelen;
518	}
519#endif
520
521#ifdef CONFIG_BOOTP_PXE_CLIENTARCH
522	clientarch = CONFIG_BOOTP_PXE_CLIENTARCH;
523#endif
524
525	if (env_get("bootp_arch"))
526		clientarch = env_get_ulong("bootp_arch", 16, clientarch);
527
528	if (clientarch > 0) {
529		*e++ = 93;	/* Client System Architecture */
530		*e++ = 2;
531		*e++ = (clientarch >> 8) & 0xff;
532		*e++ = clientarch & 0xff;
533	}
534
535	*e++ = 94;	/* Client Network Interface Identifier */
536	*e++ = 3;
537	*e++ = 1;	/* type field for UNDI */
538	*e++ = 0;	/* major revision */
539	*e++ = 0;	/* minor revision */
540
541#ifdef CONFIG_LIB_UUID
542	uuid = env_get("pxeuuid");
543
544	if (uuid) {
545		if (uuid_str_valid(uuid)) {
546			*e++ = 97;	/* Client Machine Identifier */
547			*e++ = 17;
548			*e++ = 0;	/* type 0 - UUID */
549
550			uuid_str_to_bin(uuid, e, UUID_STR_FORMAT_STD);
551			e += 16;
552		} else {
553			printf("Invalid pxeuuid: %s\n", uuid);
554		}
555	}
556#endif
557
558	e = add_vci(e);
559
560#if defined(CONFIG_BOOTP_VENDOREX)
561	x = dhcp_vendorex_prep(e);
562	if (x)
563		return x - start;
564#endif
565
566	*e++ = 55;		/* Parameter Request List */
567	 cnt = e++;		/* Pointer to count of requested items */
568	*cnt = 0;
569#if defined(CONFIG_BOOTP_SUBNETMASK)
570	*e++  = 1;		/* Subnet Mask */
571	*cnt += 1;
572#endif
573#if defined(CONFIG_BOOTP_TIMEOFFSET)
574	*e++  = 2;
575	*cnt += 1;
576#endif
577#if defined(CONFIG_BOOTP_GATEWAY)
578	*e++  = 3;		/* Router Option */
579	*cnt += 1;
580#endif
581#if defined(CONFIG_BOOTP_DNS)
582	*e++  = 6;		/* DNS Server(s) */
583	*cnt += 1;
584#endif
585#if defined(CONFIG_BOOTP_HOSTNAME)
586	*e++  = 12;		/* Hostname */
587	*cnt += 1;
588#endif
589#if defined(CONFIG_BOOTP_BOOTFILESIZE)
590	*e++  = 13;		/* Boot File Size */
591	*cnt += 1;
592#endif
593#if defined(CONFIG_BOOTP_BOOTPATH)
594	*e++  = 17;		/* Boot path */
595	*cnt += 1;
596#endif
597#if defined(CONFIG_BOOTP_NISDOMAIN)
598	*e++  = 40;		/* NIS Domain name request */
599	*cnt += 1;
600#endif
601#if defined(CONFIG_BOOTP_NTPSERVER)
602	*e++  = 42;
603	*cnt += 1;
604#endif
605	if (IS_ENABLED(CONFIG_BOOTP_PXE_DHCP_OPTION)) {
606		*e++ = 209;	/* PXELINUX Config File */
607		*cnt += 1;
608	}
609	/* no options, so back up to avoid sending an empty request list */
610	if (*cnt == 0)
611		e -= 2;
612
613	*e++  = 255;		/* End of the list */
614
615	/* Pad to minimal length */
616#ifdef	CFG_DHCP_MIN_EXT_LEN
617	while ((e - start) < CFG_DHCP_MIN_EXT_LEN)
618		*e++ = 0;
619#endif
620
621	return e - start;
622}
623
624#else
625/*
626 * Warning: no field size check - change CONFIG_BOOTP_* at your own risk!
627 */
628static int bootp_extended(u8 *e)
629{
630	u8 *start = e;
631
632	*e++ = 99;		/* RFC1048 Magic Cookie */
633	*e++ = 130;
634	*e++ = 83;
635	*e++ = 99;
636
637#if defined(CONFIG_CMD_DHCP)
638	*e++ = 53;		/* DHCP Message Type */
639	*e++ = 1;
640	*e++ = DHCP_DISCOVER;
641
642	*e++ = 57;		/* Maximum DHCP Message Size */
643	*e++ = 2;
644	*e++ = (576 - 312 + OPT_FIELD_SIZE) >> 16;
645	*e++ = (576 - 312 + OPT_FIELD_SIZE) & 0xff;
646#endif
647
648	e = add_vci(e);
649
650#if defined(CONFIG_BOOTP_SUBNETMASK)
651	*e++ = 1;		/* Subnet mask request */
652	*e++ = 4;
653	e   += 4;
654#endif
655
656#if defined(CONFIG_BOOTP_GATEWAY)
657	*e++ = 3;		/* Default gateway request */
658	*e++ = 4;
659	e   += 4;
660#endif
661
662#if defined(CONFIG_BOOTP_DNS)
663	*e++ = 6;		/* Domain Name Server */
664	*e++ = 4;
665	e   += 4;
666#endif
667
668#if defined(CONFIG_BOOTP_HOSTNAME)
669	*e++ = 12;		/* Host name request */
670	*e++ = 32;
671	e   += 32;
672#endif
673
674#if defined(CONFIG_BOOTP_BOOTFILESIZE)
675	*e++ = 13;		/* Boot file size */
676	*e++ = 2;
677	e   += 2;
678#endif
679
680#if defined(CONFIG_BOOTP_BOOTPATH)
681	*e++ = 17;		/* Boot path */
682	*e++ = 32;
683	e   += 32;
684#endif
685
686#if defined(CONFIG_BOOTP_NISDOMAIN)
687	*e++ = 40;		/* NIS Domain name request */
688	*e++ = 32;
689	e   += 32;
690#endif
691#if defined(CONFIG_BOOTP_NTPSERVER)
692	*e++ = 42;
693	*e++ = 4;
694	e   += 4;
695#endif
696
697	*e++ = 255;		/* End of the list */
698
699	/*
700	 * If nothing in list, remove it altogether. Some DHCP servers get
701	 * upset by this minor faux pas and do not respond at all.
702	 */
703	if (e == start + 3) {
704		printf("*** Warning: no DHCP options requested\n");
705		e -= 3;
706	}
707
708	return e - start;
709}
710#endif
711
712void bootp_reset(void)
713{
714	bootp_num_ids = 0;
715	bootp_try = 0;
716	bootp_start = get_timer(0);
717	bootp_timeout = 250;
718}
719
720void bootp_request(void)
721{
722	uchar *pkt, *iphdr;
723	struct bootp_hdr *bp;
724	int extlen, pktlen, iplen;
725	int eth_hdr_size;
726#ifdef CONFIG_BOOTP_RANDOM_DELAY
727	ulong rand_ms;
728#endif
729	u32 bootp_id;
730	struct in_addr zero_ip;
731	struct in_addr bcast_ip;
732	char *ep;  /* Environment pointer */
733
734	bootstage_mark_name(BOOTSTAGE_ID_BOOTP_START, "bootp_start");
735#if defined(CONFIG_CMD_DHCP)
736	dhcp_state = INIT;
737#endif
738
739	ep = env_get("bootpretryperiod");
740	if (ep != NULL)
741		time_taken_max = dectoul(ep, NULL);
742	else
743		time_taken_max = TIMEOUT_MS;
744
745#ifdef CONFIG_BOOTP_RANDOM_DELAY		/* Random BOOTP delay */
746	if (bootp_try == 0)
747		srand_mac();
748
749	if (bootp_try <= 2)	/* Start with max 1024 * 1ms */
750		rand_ms = rand() >> (22 - bootp_try);
751	else		/* After 3rd BOOTP request max 8192 * 1ms */
752		rand_ms = rand() >> 19;
753
754	printf("Random delay: %ld ms...\n", rand_ms);
755	mdelay(rand_ms);
756
757#endif	/* CONFIG_BOOTP_RANDOM_DELAY */
758
759	printf("BOOTP broadcast %d\n", ++bootp_try);
760	pkt = net_tx_packet;
761	memset((void *)pkt, 0, PKTSIZE);
762
763	eth_hdr_size = net_set_ether(pkt, net_bcast_ethaddr, PROT_IP);
764	pkt += eth_hdr_size;
765
766	/*
767	 * Next line results in incorrect packet size being transmitted,
768	 * resulting in errors in some DHCP servers, reporting missing bytes.
769	 * Size must be set in packet header after extension length has been
770	 * determined.
771	 * C. Hallinan, DS4.COM, Inc.
772	 */
773	/* net_set_udp_header(pkt, 0xFFFFFFFFL, PORT_BOOTPS, PORT_BOOTPC,
774		sizeof (struct bootp_hdr)); */
775	iphdr = pkt;	/* We need this later for net_set_udp_header() */
776	pkt += IP_UDP_HDR_SIZE;
777
778	bp = (struct bootp_hdr *)pkt;
779	bp->bp_op = OP_BOOTREQUEST;
780	bp->bp_htype = HWT_ETHER;
781	bp->bp_hlen = HWL_ETHER;
782	bp->bp_hops = 0;
783	/*
784	 * according to RFC1542, should be 0 on first request, secs since
785	 * first request otherwise
786	 */
787	bp->bp_secs = htons(get_timer(bootp_start) / 1000);
788	zero_ip.s_addr = 0;
789	net_write_ip(&bp->bp_ciaddr, zero_ip);
790	net_write_ip(&bp->bp_yiaddr, zero_ip);
791	net_write_ip(&bp->bp_siaddr, zero_ip);
792	net_write_ip(&bp->bp_giaddr, zero_ip);
793	memcpy(bp->bp_chaddr, net_ethaddr, 6);
794	copy_filename(bp->bp_file, net_boot_file_name, sizeof(bp->bp_file));
795
796	/* Request additional information from the BOOTP/DHCP server */
797#if defined(CONFIG_CMD_DHCP)
798	extlen = dhcp_extended((u8 *)bp->bp_vend, DHCP_DISCOVER, zero_ip,
799			       zero_ip);
800#else
801	extlen = bootp_extended((u8 *)bp->bp_vend);
802#endif
803
804	/*
805	 *	Bootp ID is the lower 4 bytes of our ethernet address
806	 *	plus the current time in ms.
807	 */
808	bootp_id = ((u32)net_ethaddr[2] << 24)
809		| ((u32)net_ethaddr[3] << 16)
810		| ((u32)net_ethaddr[4] << 8)
811		| (u32)net_ethaddr[5];
812	bootp_id += get_timer(0);
813	bootp_id = htonl(bootp_id);
814	bootp_add_id(bootp_id);
815	net_copy_u32(&bp->bp_id, &bootp_id);
816
817	/*
818	 * Calculate proper packet lengths taking into account the
819	 * variable size of the options field
820	 */
821	iplen = BOOTP_HDR_SIZE - OPT_FIELD_SIZE + extlen;
822	pktlen = eth_hdr_size + IP_UDP_HDR_SIZE + iplen;
823	bcast_ip.s_addr = 0xFFFFFFFFL;
824	net_set_udp_header(iphdr, bcast_ip, PORT_BOOTPS, PORT_BOOTPC, iplen);
825	net_set_timeout_handler(bootp_timeout, bootp_timeout_handler);
826
827#if defined(CONFIG_CMD_DHCP)
828	dhcp_state = SELECTING;
829	net_set_udp_handler(dhcp_handler);
830#else
831	net_set_udp_handler(bootp_handler);
832#endif
833	net_send_packet(net_tx_packet, pktlen);
834}
835
836#if defined(CONFIG_CMD_DHCP)
837static void dhcp_process_options(uchar *popt, uchar *end)
838{
839	int oplen, size;
840#if defined(CONFIG_CMD_SNTP) && defined(CONFIG_BOOTP_TIMEOFFSET)
841	int *to_ptr;
842#endif
843
844	while (popt < end && *popt != 0xff) {
845		oplen = *(popt + 1);
846		switch (*popt) {
847		case 0:
848			oplen = -1; /* Pad omits len byte */
849			break;
850		case 1:
851			net_copy_ip(&net_netmask, (popt + 2));
852			break;
853#if defined(CONFIG_CMD_SNTP) && defined(CONFIG_BOOTP_TIMEOFFSET)
854		case 2:		/* Time offset	*/
855			to_ptr = &net_ntp_time_offset;
856			net_copy_u32((u32 *)to_ptr, (u32 *)(popt + 2));
857			net_ntp_time_offset = ntohl(net_ntp_time_offset);
858			break;
859#endif
860		case 3:
861			net_copy_ip(&net_gateway, (popt + 2));
862			break;
863		case 6:
864			net_copy_ip(&net_dns_server, (popt + 2));
865#if defined(CONFIG_BOOTP_DNS2)
866			if (*(popt + 1) > 4)
867				net_copy_ip(&net_dns_server2, (popt + 2 + 4));
868#endif
869			break;
870		case 12:
871			size = truncate_sz("Host Name",
872				sizeof(net_hostname), oplen);
873			memcpy(&net_hostname, popt + 2, size);
874			net_hostname[size] = 0;
875			break;
876		case 15:	/* Ignore Domain Name Option */
877			break;
878		case 17:
879			size = truncate_sz("Root Path",
880				sizeof(net_root_path), oplen);
881			memcpy(&net_root_path, popt + 2, size);
882			net_root_path[size] = 0;
883			break;
884		case 28:	/* Ignore Broadcast Address Option */
885			break;
886		case 40:	/* NIS Domain name */
887			if (net_nis_domain[0] == 0) {
888				size = truncate_sz("NIS Domain Name",
889					sizeof(net_nis_domain), size);
890				memcpy(&net_nis_domain, popt + 2, size);
891				net_nis_domain[size] = 0;
892			}
893			break;
894#if defined(CONFIG_CMD_SNTP) && defined(CONFIG_BOOTP_NTPSERVER)
895		case 42:	/* NTP server IP */
896			net_copy_ip(&net_ntp_server, (popt + 2));
897			break;
898#endif
899		case 51:
900			net_copy_u32(&dhcp_leasetime, (u32 *)(popt + 2));
901			break;
902		case 52:
903			dhcp_option_overload = popt[2];
904			break;
905		case 53:	/* Ignore Message Type Option */
906			break;
907		case 54:
908			net_copy_ip(&dhcp_server_ip, (popt + 2));
909			break;
910		case 58:	/* Ignore Renewal Time Option */
911			break;
912		case 59:	/* Ignore Rebinding Time Option */
913			break;
914		case 66:	/* Ignore TFTP server name */
915			break;
916		case 67:	/* Bootfile option */
917			if (!net_boot_file_name_explicit) {
918				size = truncate_sz("Bootfile",
919						   sizeof(net_boot_file_name),
920						   oplen);
921				memcpy(&net_boot_file_name, popt + 2, size);
922				net_boot_file_name[size] = 0;
923			}
924			break;
925		case 209:	/* PXELINUX Config File */
926			if (IS_ENABLED(CONFIG_BOOTP_PXE_DHCP_OPTION)) {
927				/* In case it has already been allocated when get DHCP Offer packet,
928				 * free first to avoid memory leak.
929				 */
930				if (pxelinux_configfile)
931					free(pxelinux_configfile);
932
933				pxelinux_configfile = (char *)malloc((oplen + 1) * sizeof(char));
934
935				if (pxelinux_configfile)
936					strlcpy(pxelinux_configfile, popt + 2, oplen + 1);
937				else
938					printf("Error: Failed to allocate pxelinux_configfile\n");
939			}
940			break;
941		default:
942#if defined(CONFIG_BOOTP_VENDOREX)
943			if (dhcp_vendorex_proc(popt))
944				break;
945#endif
946			printf("*** Unhandled DHCP Option in OFFER/ACK:"
947			       " %d\n", *popt);
948			break;
949		}
950		popt += oplen + 2;	/* Process next option */
951	}
952}
953
954static void dhcp_packet_process_options(struct bootp_hdr *bp)
955{
956	uchar *popt = (uchar *)&bp->bp_vend[4];
957	uchar *end = popt + BOOTP_HDR_SIZE;
958
959	if (net_read_u32((u32 *)&bp->bp_vend[0]) != htonl(BOOTP_VENDOR_MAGIC))
960		return;
961
962	dhcp_option_overload = 0;
963
964	/*
965	 * The 'options' field MUST be interpreted first, 'file' next,
966	 * 'sname' last.
967	 */
968	dhcp_process_options(popt, end);
969
970	if (dhcp_option_overload & OVERLOAD_FILE) {
971		popt = (uchar *)bp->bp_file;
972		end = popt + sizeof(bp->bp_file);
973		dhcp_process_options(popt, end);
974	}
975
976	if (dhcp_option_overload & OVERLOAD_SNAME) {
977		popt = (uchar *)bp->bp_sname;
978		end = popt + sizeof(bp->bp_sname);
979		dhcp_process_options(popt, end);
980	}
981}
982
983static int dhcp_message_type(unsigned char *popt)
984{
985	if (net_read_u32((u32 *)popt) != htonl(BOOTP_VENDOR_MAGIC))
986		return -1;
987
988	popt += 4;
989	while (*popt != 0xff) {
990		if (*popt == 53)	/* DHCP Message Type */
991			return *(popt + 2);
992		if (*popt == 0)	{
993			/* Pad */
994			popt += 1;
995		} else {
996			/* Scan through all options */
997			popt += *(popt + 1) + 2;
998		}
999	}
1000	return -1;
1001}
1002
1003static void dhcp_send_request_packet(struct bootp_hdr *bp_offer)
1004{
1005	uchar *pkt, *iphdr;
1006	struct bootp_hdr *bp;
1007	int pktlen, iplen, extlen;
1008	int eth_hdr_size;
1009	struct in_addr offered_ip;
1010	struct in_addr zero_ip;
1011	struct in_addr bcast_ip;
1012
1013	debug("dhcp_send_request_packet: Sending DHCPREQUEST\n");
1014	pkt = net_tx_packet;
1015	memset((void *)pkt, 0, PKTSIZE);
1016
1017	eth_hdr_size = net_set_ether(pkt, net_bcast_ethaddr, PROT_IP);
1018	pkt += eth_hdr_size;
1019
1020	iphdr = pkt;	/* We'll need this later to set proper pkt size */
1021	pkt += IP_UDP_HDR_SIZE;
1022
1023	bp = (struct bootp_hdr *)pkt;
1024	bp->bp_op = OP_BOOTREQUEST;
1025	bp->bp_htype = HWT_ETHER;
1026	bp->bp_hlen = HWL_ETHER;
1027	bp->bp_hops = 0;
1028	bp->bp_secs = htons(get_timer(bootp_start) / 1000);
1029	/* Do not set the client IP, your IP, or server IP yet, since it
1030	 * hasn't been ACK'ed by the server yet */
1031
1032	/*
1033	 * RFC3046 requires Relay Agents to discard packets with
1034	 * nonzero and offered giaddr
1035	 */
1036	zero_ip.s_addr = 0;
1037	net_write_ip(&bp->bp_giaddr, zero_ip);
1038
1039	memcpy(bp->bp_chaddr, net_ethaddr, 6);
1040	copy_filename(bp->bp_file, net_boot_file_name, sizeof(bp->bp_file));
1041
1042	/*
1043	 * ID is the id of the OFFER packet
1044	 */
1045
1046	net_copy_u32(&bp->bp_id, &bp_offer->bp_id);
1047
1048	/*
1049	 * Copy options from OFFER packet if present
1050	 */
1051
1052	/* Copy offered IP into the parameters request list */
1053	net_copy_ip(&offered_ip, &bp_offer->bp_yiaddr);
1054	extlen = dhcp_extended((u8 *)bp->bp_vend, DHCP_REQUEST,
1055		dhcp_server_ip, offered_ip);
1056
1057	iplen = BOOTP_HDR_SIZE - OPT_FIELD_SIZE + extlen;
1058	pktlen = eth_hdr_size + IP_UDP_HDR_SIZE + iplen;
1059	bcast_ip.s_addr = 0xFFFFFFFFL;
1060	net_set_udp_header(iphdr, bcast_ip, PORT_BOOTPS, PORT_BOOTPC, iplen);
1061
1062	debug("Transmitting DHCPREQUEST packet: len = %d\n", pktlen);
1063	net_send_packet(net_tx_packet, pktlen);
1064}
1065
1066/*
1067 *	Handle DHCP received packets.
1068 */
1069static void dhcp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
1070			 unsigned src, unsigned len)
1071{
1072	struct bootp_hdr *bp = (struct bootp_hdr *)pkt;
1073
1074	debug("DHCPHandler: got packet: (src=%d, dst=%d, len=%d) state: %d\n",
1075	      src, dest, len, dhcp_state);
1076
1077	/* Filter out pkts we don't want */
1078	if (check_reply_packet(pkt, dest, src, len))
1079		return;
1080
1081	debug("DHCPHandler: got DHCP packet: (src=%d, dst=%d, len=%d) state: "
1082	      "%d\n", src, dest, len, dhcp_state);
1083
1084	if (net_read_ip(&bp->bp_yiaddr).s_addr == 0) {
1085#if defined(CONFIG_SERVERIP_FROM_PROXYDHCP)
1086		store_bootp_params(bp);
1087#endif
1088		return;
1089	}
1090
1091	switch (dhcp_state) {
1092	case SELECTING:
1093		/*
1094		 * Wait an appropriate time for any potential DHCPOFFER packets
1095		 * to arrive.  Then select one, and generate DHCPREQUEST
1096		 * response.  If filename is in format we recognize, assume it
1097		 * is a valid OFFER from a server we want.
1098		 */
1099		debug("DHCP: state=SELECTING bp_file: \"%s\"\n", bp->bp_file);
1100#ifdef CONFIG_SYS_BOOTFILE_PREFIX
1101		if (strncmp(bp->bp_file,
1102			    CONFIG_SYS_BOOTFILE_PREFIX,
1103			    strlen(CONFIG_SYS_BOOTFILE_PREFIX)) == 0) {
1104#endif	/* CONFIG_SYS_BOOTFILE_PREFIX */
1105			if (CONFIG_IS_ENABLED(UNIT_TEST) &&
1106			    dhcp_message_type((u8 *)bp->bp_vend) == -1) {
1107				debug("got BOOTP response; transitioning to BOUND\n");
1108				goto dhcp_got_bootp;
1109			}
1110			dhcp_packet_process_options(bp);
1111			if (CONFIG_IS_ENABLED(EFI_LOADER) &&
1112			    IS_ENABLED(CONFIG_NETDEVICES))
1113				efi_net_set_dhcp_ack(pkt, len);
1114
1115#if defined(CONFIG_SERVERIP_FROM_PROXYDHCP)
1116			if (!net_server_ip.s_addr)
1117				udelay(CONFIG_SERVERIP_FROM_PROXYDHCP_DELAY_MS *
1118					1000);
1119#endif	/* CONFIG_SERVERIP_FROM_PROXYDHCP */
1120
1121			debug("TRANSITIONING TO REQUESTING STATE\n");
1122			dhcp_state = REQUESTING;
1123
1124			net_set_timeout_handler(5000, bootp_timeout_handler);
1125			dhcp_send_request_packet(bp);
1126#ifdef CONFIG_SYS_BOOTFILE_PREFIX
1127		}
1128#endif	/* CONFIG_SYS_BOOTFILE_PREFIX */
1129
1130		return;
1131		break;
1132	case REQUESTING:
1133		debug("DHCP State: REQUESTING\n");
1134
1135		if (dhcp_message_type((u8 *)bp->bp_vend) == DHCP_ACK) {
1136dhcp_got_bootp:
1137			dhcp_packet_process_options(bp);
1138			/* Store net params from reply */
1139			store_net_params(bp);
1140			dhcp_state = BOUND;
1141			printf("DHCP client bound to address %pI4 (%lu ms)\n",
1142			       &net_ip, get_timer(bootp_start));
1143			net_set_timeout_handler(0, (thand_f *)0);
1144			bootstage_mark_name(BOOTSTAGE_ID_BOOTP_STOP,
1145					    "bootp_stop");
1146
1147			net_auto_load();
1148			return;
1149		}
1150		break;
1151	case BOUND:
1152		/* DHCP client bound to address */
1153		break;
1154	default:
1155		puts("DHCP: INVALID STATE\n");
1156		break;
1157	}
1158}
1159
1160void dhcp_request(void)
1161{
1162	bootp_request();
1163}
1164#endif	/* CONFIG_CMD_DHCP */
1165